Removed “Powered by MutoPay” attribution from the default checkout description shown to customers. Per WordPress.org guidelines, credit links must not appear on user-facing interfaces without explicit admin opt-in. Merchants can still add any description they choose in the gateway settings.
1.0.3
Annotated Plugin Check warnings: the connect (OAuth) callback uses a state token rather than a nonce for CSRF, and the cron poller’s order meta query is intentionally bounded.
1.0.2
Security: added a one-time state parameter to the MutoPay connect (OAuth) callback to defend against CSRF, plus an explicit capability check on the callback handler.
1.0.1
Moved inline admin scripts into enqueued JS files for WordPress.org guideline compliance.
